HAZY_TIGER__2019__Suspected_BITTER_APT_Continues_Targeting_Government_of_China_and_Chinese_Organizations_Anomali.pdf

Anomali researchers identified an active phishing campaign, attributed to the suspected "BITTER APT", targeting Chinese government agencies and state-owned organisations by deploying spoofed webmail login pages (using Let's Encrypt DV certificates) to harvest credentials; the report enumerates multiple malicious domains, hosting providers and IPs, provides screenshots and indicators of compromise, and assesses the campaign as likely espionage-motivated.